Skip to content

Possible issue with unavailable CryptoIntegration when using keycloak-authz-client with private_key_jwt and ECDSA algorithm #32962

@mposolda

Description

@mposolda

Description

I think that if someone tries to use keycloak-authz-client together with private_key_jwt authentication ( JWTClientCredentialsProviders) and the algorithm ECDSA, it will probably fail with the exception like Not able to load any cryptoProvider with the classLoader: ... .

For our keycloak-client testsuite, we have workaround to implement DummyCryptoProvider in the testsuite - https://github.com/keycloak/keycloak-client/pull/56/files . But I think this may not work for user's applications unless they implement the DummyCryptoProvider themselves in their application or they include keycloak-core (together with keycloak-crypto-default and bouncycastle) to their classpath, which is not good.

Possible solutions:

  1. Update the code of keycloak-authz-client to not rely on CryptoIntegration . Maybe something similar like was done for SAML adapter in those commits:
    dad4477
    125124c
    I think we can also move ClientCredentialsProvider (or only some implementations like JWTClientCredentialsProvider) directly to keycloak-authz-client-tests as this code is not needed inside Keycloak server at all. With the adapter, the keycloak-authz-client is the only component, which needs ClientCredentialsProvider AFAIK. Then we can update JWTClientCredentialsProvider more easily to use the code not relying on CryptoIntegration, but rather snippets currently used by DummyCryptoProvider from the PR https://github.com/keycloak/keycloak-client/pull/56/files .

  2. Have DummyCryptoProvider directly in keycloak-authz-client. But I think this option may be problematic as in keycloak testsuite, there are both keycloak-crypto-default and keycloak-authz-client-tests on classpath, which can mean multiple crypto providers causing further issues

  3. Some other option?

### Tasks
- [ ] https://github.com/keycloak/keycloak/issues/33831
- [ ] https://github.com/keycloak/keycloak-client/issues/82

Metadata

Metadata

Assignees

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions